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ELECTRIC EMERGENCY INCIDENT AND 
DISTURBANCE REPORT 


OMB No. 1901-0288 
Approval Expires: 95/31/2021 
Burden Pei; Response: 1.8 hours 


NOTICE: Hus report is mandatory under Public Law 93-275. Failure to comply may result in criminal fines, civil penalties and other sanctions as provided by 
law. For the sanctions and the provisions concerning the confidentiality of information submitted on this form, see General Information portion of the instructions. 
Tide 18 USC1001 nukes it a criminal offense for any person knowingly and willingly to make to any Agency or Department of the United States any false, 
fictitious, or fraudulent statements as to any matter within its jurisdiction._ 


RESPONSE DUE: 

Within 1 hour of the incident, submit Schedule 1 and lines M - Q in Schedule 2 as an Emergency Alert report if criteria 1-8 are met. 

Within 6 hours of the incident submit .Schedule 1 and lines M - Q in Schedule 2 as a Normal Report if only criteria 9-12 are met. 

By the later of 24 hours after the recognition of the incident OR by the end of the nest business day submit Schedule 1 & lines M - Q in Schedule 2 as a System 
Report if criteria 13-24 are met Note 4 00pm local time will be considered the and of the business day 

Submit updates as needed and/or a final report (all of Schedules 1 and 2) within 72 hours of the incident. 

For NERC reporting entities registered in the United States; NERC has approved that the form OE-417 meets the submittal requirements for NERC. There may 
be other aoobcable regional, state and local reporting requirements. 


METHODS OF FILING RESPONSE 
(Retain a completed copy of this form for your files.) 


Online: Submit form via online submission at: htti>s://www.oe.ned.doe gov/OE417/ 

FAX: FAX Form OE-417 to the following facsimile number (202) 585-8485. 

Alternate: If you are unable to submit online or by fax, forms may be e-mailed to doehr 

following telephone number: (202) 586-8100. 


neoc@ha.doe. gov , or call and report the information to the 


SCHEDULE 1 - ALERT CRITERIA 


age 1 of 4) 


EMERGENCY ALERT 
File witluu 1-Hour 

If any box 1-8 on the right is 
checked, this form must be 
filed within 1 horn of the 
incident; check Emergency 
Alert (for the Alert Status) on 
Line A below. 


NORMAL REPORT 
File within 6-Hours 

If any box 9-12 on the right is 
checked AND none of the 
boxes 1-8 are checked, this 
form must be filed within 6 
hours of the incident; check 
Normal Report (for the Alert 
Status) on Line A below. 


iWSIPlBWWWBl 


See Instructions For More Information 


1. [ ] Physical attack that causes major interruptions or impacts to critical infrastructure facilities or to operations 

2. [X] Cyber event that causes interruptions of electrical system operations 

3. [ ] Complete operational failure or shut-down of the transmission and/or distribution electrical system 

4. [ ] Electrical System Separation (Islanding) where part or parts of a power grid remain(s) operational in an otherwise 

blacked out area or within the partial failure of an integrated electrical system 

5. [ ] Uncontrolled loss of 300 Megawatts or more of firm system loads for 15 minutes or more from a single 

incident 

6. ( ] Finn load shedding of 100 Megawatts or more implemented under emergency operational policy 

7. [ ] System-wide voltage reductions of 3 percent or more 

8. [ J Public appeal to reduce the use of electricity for purposes of maintaining the continuity of the Bulk Electric System 


9. ( ] Physical attack that could potentially impact electric power system adequacy or reliability; or vandalism which 

targets components of any security systems 

10. [X 3 Cyber event that could potentially impact electric power system adequacy or reliability 

11. [ ] Loss of electric service to more than 50,000 customers for 1 hour or more 

12. [ ] Fuel supply emergencies that could impact electric power system adequacy or reliability 
















SYSTEM REPORT 
File within 1-Business Day 
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SCHEDULE 1 - ALERT CRITERIA - CONTINUED 

(Page 2 of 4) 


13. [ ] Damage or destruction of a Facility within its Reliability Coordinator Area, Balancing Authority Area or 

Transmission Operator Area that results in action(s) to avoid a Bulk Electric System Emergency. 

14. [ ] Damage or destruction of its Facility that results from actual or suspected intentional human action. 

15. [ ] Physical threat to its Facility excluding weather or natural disaster related threats, which has the potential to 

degrade the normal operation of the Facility. Or suspicious device or activity at its Facility. 

16. [ ] Physical threat to its Bulk Electric System control center, excluding weather or natural disaster related threats, which 

has the potential to degrade the normal operation of the control center. Or suspicious device or activity at its Bulk 
Electric System control center. 


If any box 13-24 on the right is 17. [ ] Bulk Electric System Emergency resulting in voltage deviation on a Facility; A voltage deviation equal to or 

checked AND none of the greater than 10% of nominal voltage sustained for greater than or equal to 15 continuous minutes, 

boxes 1-12 are checked, this 

form must be filed by the later 18. [ j Uncontrolled loss of 200 Megawatts or more of firm system loads for 15 minutes or more front a single incident for 
of 24 hours after the entities with previous year’s peak demand less than or equal to 3,000 Megawatts 

recognition of the incident OR 

by the end of the next business j 9. [ ] Total generation loss, within one minute of: greater than or equal to 2,000 Megawatts in the Eastern or Western 

day. Nota 4:00pm local time Interconnection or greater than or equal to 1,400 Megawatts in the ERCOT Interconnection, 

will be considered the end of 

the business day. Check 20. [ ) Complete loss of off-site power (LOOP) affecting a nuclear generating station per the Nuclear Plant Interface 

System Report (for the Alert Requirements. 

Status) on Line A below. 

21. [ ] Unexpected Transmission loss within its area, contrary to design, of three or more Bulk Electric System 

Facilities caused by a common disturbance (excluding successful automatic reclosing). 

22. [ ] Unplanned evacuation from its Bulk Electric System control center facility for 30 continuous minutes or more. 

23. [ j Complete loss of Interpersonal Communication and Alternative Interpersonal Communication capability affecting 

its staffed Bulk Electric System control center for 30 continuous minutes or more. 

24. [ 3 Complete loss of monitoring or control capability at its staffed Bulk Electric System control center for 30 

continuous minutes or more. 


If significant changes have occurred after filing die initial report, re-file the form with the changes and check Update (for the Alert Status) on Line A below. 
The form mast be re-filed within 72 liours of the incident with the latest information and Final (Alert Status) checked on Liue A below, unless updated 


A. 

Alert Status (check one) 

Emergency Alert 

C J 

1 Hour 

Normal Report 
[ 1 

6 Hours 

System Report 
[ 1 

1 Business Day 

Update 
{ ) 

As required 

Final 

rxi 

72 Hours 

B. 

Organization Name 

sPower 



2180 South 1300 East Suite 600 Salt Lake City Utah 84106 


Address of Principal Business Office 


















B U.S. Department of Enerf 
Electricity Delivery and 
j Energy Reliability. 

For in OE-417 


ELECTRIC EMERGENCY INCIDENT AND 
DISTURBANCE REPORT 
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OMB No. 1901 0288 
Approval Expires: 05/31/2021 
Burden Per Responses: X8 hours 


SCHEDULE 1 - ALERT NOTICE 

3 of 4) 


pail iSigpiis# 



Geographic Area(s) Affected 
(County, State) _ 


Dnte/Time Incident Began 
(mm-dd-w/bhurn) using 24-hour dock 


Date/Time Incident Ended 
(mm-dd-yv/ hh:nnri) using 24-houx dock 


Estimate of Amount of Demand Involved 
(Peak Megawatts) 


Estimate of Number of Customere Affected 


California: Kem County, Los Angeles County; Utah: Salt Lake County; Wyoming: Converse County; 



dd 


Yes [ ] 



No [ ] 

Unknown [X] 

Zero {XI 

Unknown [ ] 

Zero [X] 

Unknown [ ] 


J. Cause 


SCHEDULE 1 - TYPE OF EMERGENCY 

Check ail that apply 


K. Impact 


L. Action Taken 


□ Unknown 

□ Physical attack 

□ Threat of physical attack 

□ Vandalism 

□ Theft 

□ Suspicious activity 

□ Cyber event (information technology) 

IS Cyber event (operational technology) 

□ Fuel supply emergencies, interruption, or 

deficiency 

□ Generator loss or failure not due to fuel supply 
interruption or deficiency or transmission 
failure 

□ Transmission equipment failure (not including 
substation or switchyard) 

□ Failure at high voltage substation or switchyard 

□ Weather or natural disaster 

□ Operator action(s) 

□ Other 

IS Additional Infonnation/Comments: 

Initial assessment revealed that a firewall exploit was likely utilized to 
execute a denial of service attack that caused the firewaJs to reboot 
teotfng to an approximately S minute or less eommunications outage 


□ None 

□ Control center loss, failure, or evacuation 

□ Loss or degradation of control center monitoring 
or communication systems 

□ Damage or destruction of a facility 

□ Electrical system separation (islanding) 

□ Complete operational failure or shutdown of the 
transmission and/or distribution system 

□ Major transmission system interruption (three or 
more BES elements) 

□ Major distribution system interruption 

□ Uncontrolled loss of 200 MW or more of firm 
system loads for 15 minutes or more 

□ Loss of electric service to more than 50,000 
customers for 1 hour or more 

□ System-wide voltage reductions or 3 percent or 
more 

□ Voltage deviation on an individual facility of 
>10% for 15 minutes or more 

D Inadequate electric resources to serve load 

□ Generating capacity loss of 1,400 MW or more 

□ Generating capacity loss of 2,000 MW or more 

□ Complete loss of off-site power to a nuclear 
generating station 

£1 Other 

IS Additional Information/Comments: 

Firewall refloats resulted in brief communicaticra outages 
(approximately 5 minutes or less) between field devices a! sites and 
between the sites and sPoweFs Control Center 


□ None 

□ Shed Firm Load: Load shedding of 100 
MW or more implemented under 
emergency operational policy (manually 
or automatically via UFLS or remedial 
action scheme) 

□ Public appeal to reduce the use of 
electricity for the purpose of maintaining 
the continuity of the electric power 
system 

□ Implemented a warning, alert, or 
contingency plan 

□ Voltage reduction 

□ Shed Interruptible Load 

□ Repaired or restored 

□ Mitigation implemented 

S3 Other 

SI Additional Infonnation/Comments 
After teaming of Die potential cause of the refcxxk, sPower 
started testing and deployment of an update to remove Die 
exploited vutnerabikty 
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SCHEDULE 2 - NARRATIVE DESCRIPTION 


(Page 4 of 4) 

Information on Schedule 2 will not be disclosed to the public to the extent that it satisfies the criteria for exemption under the Freedom ofInformation Act, e.g. 
exemptions for confidential commercial information and trade secrets, certain information that could endanger the physical safety ofan individual, or 

information designated as Critical Energy Infrastructure Information. _ 


Name 


director, 0; 


E-mail Address 


iovffir.com 


Provide a description of the incident and actions taken to resolve it. Include as appropriate, the cause of the incident/disturbance, change in frequency, 
mitigation actions taken, equipment damaged, critical infrastructures interrupted, effects on other systems, and preliminary results bom any 
investigations. Be sure to identify: the estimate restoration date, die name of any lost high voltage substations or switchyards, whether there was any 
electrical system separation (and if there were, what the islanding boundaries were), and the name of the generators and voltage lines that were lost 
(shown by capacity' type and voltage size grouping). If necessary, copy and attach additional sheets. Equivalent documents, containing this information can 
be supplied to meet die requirement; this includes the NERC EOP-004 Disturbance Report. Along with the filing of Schedule 2, a final (updated) Schedule 1 
needs to be filed. Check the Final box an line A for Alert Status on Schedule 1 and submit this and the completed Schedule 2 no later than 72 hours 
after detection that a criterion was met. __- . ■ - V : ' ■" ■ . ■ ’ : • : . _ 


R. Narrative:'. 

sPowef is a Generator Owner and Generator Operator of wind and solar generation assets that are operated from a Control Center in Salt Lake City, UT.(b) (7)(E) 


S. Estimated Restoration Date for all Affected Customers 
Who Can Receive Power 


Pioneer, 8eacon 4, ABSR, DSR1, DSR2, Beacon 1, Elevation C, WABSRB, Bayshore A Baysbore B, Bayshote C, Solverde, 


firewal at a Power headquarters 


NERC is an entity that is certified by the Federal Energy Regulatory Commission to establish and enforce reliability 
standards for the bulk power system but that is not part of the Federal Government This information would be 
submitted to help fulfill the respondent's requirements under NERC’s reliability standards. 


U. Notify NERC/E-ISAC 


If approval is given to alert NERC and/or E-ISAC the Form will be emailed to systeinawareness^nercjiet and/or 
operations@eisac.com when it is submitted to DOE. DOE is not responsible for ensuring the receipt of these emails 

® . v by NERC and/or EdSAC. 



OMB No. 1901-0288 

ELECTRIC EMERGENCY INCIDENT AND 

| Approval Expires: 05/31/2021 

DISTURBANCE REPORT i 

Barden Per Response :1.8 hours 



































